X-Industry

Ontinue’s 1H 2026 threat report shows attackers increasingly abusing Microsoft Teams, npm packages, device-code logins, and blockchain ClickFix tactics to steal access and spread malware.[1]

Cybercriminals increasingly abuse legitimate business tools to access organizations, steal credentials, and spread malware, rather than relying only on software vulnerabilities, according to Ontinue’s 1H 2026 Threat Intelligence Report.[2]  The report describes how these tactics are showing up across workpla

Security researchers have uncovered a new supply chain attack targeting the NPM registry with malicious code that exhibits worm-like propagation capabilities.  Named Sandworm_Mode, the attack was deployed through 19 packages published under two aliases, which relied on typo squatting to trick developers into executing the malicious code.  According to cybersecurity firm Socket, the attack bears the hallmarks of the Shai-Hulud campaign that hit roughly 800 NPM packages in September and November 2

Many malware attacks against open-source software components have compromised thousands of software packages and repositories, but the practical damage these attacks have caused organizations is harder to quantify.  The longer-term and indirect costs of these attacks may prove most significant for organizations.  Open-source components and software have long been a well-established source of threat activity. The widespread use, combined with the broad variance in how well-supported different pro